identity

Identity

KQL queries for user behavior analysis and Identity Access Management (IAM) monitoring.

Contents

• Authentication
• Privileged Access
• Suspicious Behavior

Authentication

// Detect impossible travel - login from two different locations - T1078
SigninLogs
| where ResultType == 0
| summarize Locations = make_set(Location) by UserPrincipalName
| where array_length(Locations) > 1

// Detect logins outside business hours - T1078
SigninLogs
| where ResultType == 0
| where hourofday(TimeGenerated) !between (8 .. 18)
| project TimeGenerated, UserPrincipalName, Location, IPAddress

// Detect multiple failed MFA attempts - T1110
SigninLogs
| where ResultType == 50074
| summarize FailedMFA = count() by UserPrincipalName
| where FailedMFA > 5
| order by FailedMFA desc

// Detect logins from anonymous IP addresses - T1090
SigninLogs
| where RiskEventTypes has "anonymizedIPAddress"
| project TimeGenerated, UserPrincipalName, IPAddress, Location
| order by TimeGenerated desc

Privileged Access

// Detect new privileged role assignments - T1078.004
AuditLogs
| where OperationName == "Add member to role"
| project TimeGenerated, InitiatedBy, TargetResources
| order by TimeGenerated desc

// Detect service principal additions - T1136.003
AuditLogs
| where OperationName == "Add service principal"
| project TimeGenerated, InitiatedBy, TargetResources
| order by TimeGenerated desc

Suspicious Behavior

// Detect user account created outside business hours - T1136
AuditLogs
| where OperationName == "Add user"
| where hourofday(TimeGenerated) !between (8 .. 18)
| project TimeGenerated, InitiatedBy, TargetResources
| order by TimeGenerated desc

// Detect bulk user deletion - T1531
AuditLogs
| where OperationName == "Delete user"
| summarize DeleteCount = count() by bin(TimeGenerated, 1h)
| where DeleteCount > 5
| order by TimeGenerated desc